#1 Trusted Cybersecurity News Platform
Followed by 5.20+ million
The Hacker News Logo
Subscribe – Get Latest News

DNS poisoning | Breaking Cybersecurity News | The Hacker News

Category — DNS poisoning
China-Linked Hackers Compromise ISP to Deploy Malicious Software Updates

China-Linked Hackers Compromise ISP to Deploy Malicious Software Updates

Aug 05, 2024 Browser Security / Windows Security
The China-linked threat actor known as Evasive Panda compromised an unnamed internet service provider (ISP) to push malicious software updates to target companies in mid-2023, highlighting a new level of sophistication associated with the group. Evasive Panda, also known by the names Bronze Highland, Daggerfly, and StormBamboo, is a cyber espionage group that's been active since at least 2012, leveraging backdoors such as MgBot (aka POCOSTICK) and Nightdoor (aka NetMM and Suzafk) to harvest sensitive information. More recently, the threat actor was formally attributed to the use of a macOS malware strain called MACMA, which has been observed in the wild as far back as 2021. "StormBamboo is a highly skilled and aggressive threat actor who compromises third-parties (in this case, an ISP) to breach intended targets," Volexity said in a report published last week. "The variety of malware employed in various campaigns by this threat actor indicates significant ef...
Unpatched DNS Related Vulnerability Affects a Wide Range of IoT Devices

Unpatched DNS Related Vulnerability Affects a Wide Range of IoT Devices

May 03, 2022
Cybersecurity researchers have disclosed an unpatched security vulnerability that could pose a serious risk to IoT products. The issue, which was originally reported in September 2021, affects the Domain Name System (DNS) implementation of two popular C libraries called  uClibc  and  uClibc-ng  that are used for developing embedded Linux systems. uClibc is known to be used by major vendors such as Linksys, Netgear, and Axis, as well as Linux distributions like Embedded Gentoo, potentially exposing millions of IoT devices to security threats. "The flaw is caused by the predictability of transaction IDs included in the DNS requests generated by the library, which may allow attackers to perform DNS poisoning attacks against the target device," Giannis Tsaraias and Andrea Palanca of Nozomi Networks  said  in a Monday write-up. DNS poisoning , also referred to as DNS spoofing, is the technique of corrupting a DNS resolver cache — which provides clients wi...
Oops! WikiLeaks Website Defaced By OurMine

Oops! WikiLeaks Website Defaced By OurMine

Aug 31, 2017
OurMine is in headlines once again—this time for defacing WikiLeaks website. The notorious hacking group, OurMine, is known for breaching into high-profile figures and companies' social media accounts, including Facebook CEO Mark Zuckerberg , Twitter CEO Jack Dorsey , Google CEO Sundar Pichai , HBO , Game of Thrones and Sony's PlayStation Network (PSN). According to screenshots circulating on Twitter , the official website of WikiLeaks has reportedly been defaced by the OurMine hacking group, who left a message on the site, as shown above. WikiLeaks is a whistleblowing website that since March, has been revealing top CIA hacking secrets under Vault 7 , including the agency's ability to break into different mobile and desktop platforms , security camera live video streams , air-gap computers and many more. There is no indication of WikiLeaks servers and website been compromised, instead it seems their website has been redirected to a hacker-controlled server ...
cyber security

Creating, Managing and Securing Non-Human Identities

websitePermisoCybersecurity / Identity Security
A new class of identities has emerged alongside traditional human users: non-human identities (NHIs). Permiso Security's new eBook details everything you need to know about managing and securing non-human identities, and strategies to unify identity security without compromising agility.
Oops! TP-Link forgets to Renew and Loses its Domains Used to Configure Router Settings

Oops! TP-Link forgets to Renew and Loses its Domains Used to Configure Router Settings

Jul 06, 2016
To make the configuration of routers easier, hardware vendors instruct users to browse to a domain name rather than numeric IP addresses. Networking equipment vendor TP-LINK uses either tplinklogin.net or tplinkextender.net for its routers configuration. Although users can also access their router administration panel through local IP address (i.e. 192.168.1.1). The first domain offered by the company is used to configure TP-LINK routers and the second is used for TP-LINK Wi-Fi extenders. Here's the Blunder: TP-Link has reportedly " forgotten " to renew both domains that are used to configure its routers and access administrative panels of its devices. Both domains have now been re-registered using an anonymous registration service by an unknown entity and are being offered for sale online at US$2.5 Million each. This latest TP-Link oversight, which was first spotted by Cybermoon CEO Amitay Dan, could lead its users to potential problems. However, it ...
SRTT Vulnerability in BIND Software Puts DNS Protocol Security At Risk

SRTT Vulnerability in BIND Software Puts DNS Protocol Security At Risk

May 06, 2014
After the Heartbleed bug that exposed half of the Internet vulnerable to hackers thereby marking as one of the largest Internet vulnerability in recent history, the critical flaw in the implementation of the DNS protocol could also represent a serious menace to the Internet security. A Serious security vulnerability has been discovered in the algorithms of DNS software – BIND by the two Israeli students ' Roee Hay ' and ' Jonathan Kalechstein ', who are working under a project out at the Laboratory of Computer Communication & Networking in the Faculty of Computer Science at the Technion , which was led by Dr. Gabi Nakibly from Rafael (Rafael Advanced Defense Systems Ltd.). Although, Technion students have not provided any detail explanation about the vulnerability , but indicated that by exploiting the DNS protocol flaw an attacker could redirect the users who are trying to visit a legitimate website to a fake and bogus website which the attacker con...
Qatar is Down ! Syrian Electronic Army hijacks major Qatar websites

Qatar is Down ! Syrian Electronic Army hijacks major Qatar websites

Oct 19, 2013
The Syrian Electronic Army (SEA) is at it again. The hacktivist group, who are known to back Syrian President Bashar al-Assad , has hacked many high profile Qatar based websites, including the Google, Facebook, Aljazeera and Government - Military websites. Starting at about 4:25 am (GMT 5:30+), the Syrian Electronic Army shared this message on Twitter: Qatar is #down and  following that, they went about switching off government and private websites using the .qa extension. The domains are managed by Qatar's Ministry of Information and Communication (ictQatar). Apparently, the Syrian Electronic Army gained access to  Qatar Domain Registrar ( portal.registry.qa ) and modifies the DNS entires to redirects the targeted websites to servers controlled by hackers serving defacement page, that include a picture of Assad and the groups logo, as shown. The List of the targeted websites is posted on Twitter by hackers - these include: moi . gov .qa facebook .qa gov ....
Metasploit website Hacked just by sending a spoofed DNS change request via Fax to Domain Registrar

Metasploit website Hacked just by sending a spoofed DNS change request via Fax to Domain Registrar

Oct 11, 2013
A group of Pro-Palestine hackers ' KDMS Team ' today has been able to hijack the Metasploit website simply by sending a fax and hijacked their DNS records. Rapid7 is a leading Security Company and Creator of world's best penetration testing software called ' Metasploit '. The company confirmed via Twitter that Metasploit.com was hacked via a spoofed DNS change request sent via fax to its registrar, Register.com . The group came to prominence earlier this week when it managed to hijack the websites of popular messaging service WhatsApp and anti-virus company AVG among others. On the website, the hacker posted " Hello Metasploit.  After Whatsapp , Avira, Alexa , AVG and other sites. We were thinking about quitting hacking and disappear again! But we said: there is some sites must be hacked. You are one of our targets. Therefore we are here. And there is another thing do you know Palestine? " Rapid7 official statement regarding the in...
World's Largest Web Hosting company 'LeaseWeb' Hacked by KDMS Team

World's Largest Web Hosting company 'LeaseWeb' Hacked by KDMS Team

Oct 05, 2013
LeaseWeb , one of the World's largest hosting provider has been defaced by Palestinian hackers, named as KDMS Team . LeaseWeb was also hosting provider for one of the biggest file-sharing website Megaupload in the past. Later Megaupload Founder, Kim Dotcom claimed that  Leaseweb had deleted all Megaupload user data from 690 servers without warning. The hacker group replaced the Homepage of the website for just a few hours with an Anonymous Palestine , homepage titled " You Got Pwned " and the defacement message says: Hello Lease Web Who Are You ? Who is but the form following the function of what and what are you is a hosting company with no security KDMS Team : Well ,, We Can See That :P We noticed that Attacker has just changed the DNS server to point the Domain to another server at 67.23.254.6, owned by the attacker. At the time of writing, Leaseweb team resolved the issue and get their Domain back to the original server . But becau...
Malawi Google ,MSN, Yahoo domains defaced by TiGER-M@TE

Malawi Google ,MSN, Yahoo domains defaced by TiGER-M@TE

Feb 14, 2013
Famous Bangladeshi hacker TiGER-M@TE  known for his big defacements strikes again! This time he teams up with another hacker ' h311 c0d3 ' for another big defacement campaign.  According to mirror records on Zone-H, These hackers managed to deface Malawi Google, Yahoo, MSN, Windows and many more top domains using DNS poisoning attack. During talk with ' The Hacker News ', hackers disclose that they collectively hacked into Malawi (.mw) Domain Registrar website and also target Master and Slave DNS servers. The attackers changed the authoritative DNS records for the affected domains, to point the domain names to their own web server with a deface page hosted on it. All this could have been much worse if the attacker had other goals in his mind rather than defacing famous websites. Imagine how many accounts could have been compromised, if these websites were redirected to a phishing page, instead of a defacement page. At the time of reporting, D...
Bicololo malware spreading via 404 Error targeting Russians

Bicololo malware spreading via 404 Error targeting Russians

Feb 05, 2013
A Trojan that attacks Russian Internet users using a new trick to spread itself. Known as " Bicololo " was first discovered in October 2012 and specially designed to steal login credentials from users.  For this, the malware modify the system Hosts file (i.e etc/hosts) to host perfect phishing sites via DNS poisoning to collect social networking and email credentials. In a recent post from Avast antivirus,  Bicololo  continued to evolve and spread even further. Because it is difficult for a user to determine that he is redirected to a phishing site the attack going smoothly. In Oct, They found that all these phishing sites were resolving via servers located at 69.197.136.99, 94.249.188.224 and 178.63.214.97, 94.249.189.21 , which originally were hosted on afraid.org servers. But now this malware spreading via standard 404 Error webpage error of hacked sites. The most frequent phishing clones of vk.com , odnokl...
Turkmenistan Gmail, Microsoft, Youtube Domains Hijacked

Turkmenistan Gmail, Microsoft, Youtube Domains Hijacked

Jan 25, 2013
Iranian hackers deface multiple big companies Turkmenistan domains (.tm) yesterday using DNS poisoning attack. All hacked domains are registered by NIC at Turkmenistan. Hacker managed to find and exploit a SQL Injection vulnerability in NIC website in order to get database of the site. Because the passwords was stored in plain text, that make more easy for those hacker to access the domain panels of each domain and changing the DNS entries to shift websites on a rouge server with defaced page. The defaced message as shown below: Defaced domains : www.youtube.tm www.gmail.tm www.msdn.tm www.intel.tm www.officexp.tm www.xbox.tm www.windowsvista.tm www.orkut.tm www.google.tm Mirror of hacks are available at Zone-H .
Expert Insights / Articles Videos
Cybersecurity Resources